CentralMind Gateway Documentation

The Presidio Anonymizer Plugin integrates with Microsoft's Presidio to detect and anonymize sensitive PII (Personally Identifiable Information) within your data fields.

It operates in two stages:

1. Detection: Uses the Presidio Analyzer API to identify PII entities.
2. Anonymization: Uses the Presidio Anonymizer API to apply transformations to the detected entities based on your configured rules.

If no PII is detected, the original data is returned unchanged.

The following features are planned for future releases and are subject to change based on user feedback:

Database and Connectivity

• Extended Database Integrations: Support for Databricks, Redshift, S3 (Iceberg and Parquet), Oracle DB, Microsoft SQL Server, and Elasticsearch.
• SSH tunneling: Ability to use a jumphost or SSH bastion to tunnel connections.

Enhanced Functionality

• Advanced Query Capabilities: Complex filtering syntax and aggregation functions passed as parameters.
• Enhanced MCP Security: Implementation of API key and OAuth authentication.

Platform Improvements

• Schema Management: Automated schema evolution and API versioning.
• Advanced Traffic Management: Intelligent rate limiting and request throttling.
• Write Operations Support: Support for Insert and Update operations.

The project follows a standard Astro + Starlight structure. Key directories and files include:

• src/content/docs/: This is where you create your documentation. Starlight exposes every .md or .mdx file in this directory as a route based on its filename.
• src/assets/: Place images here to embed them in your Markdown using relative links.
• public/: Place static assets that do not need processing (like favicons) here.
• astro.config.mjs: The main configuration file for the Astro project.
• package.json: Defines dependencies and scripts.

.
├── public/
├── src/
│   ├── assets/
│   ├── content/
│   │   ├── docs/
│   │   └── config.ts
│   └── env.d.ts
├── astro.config.mjs
├── package.json
└── tsconfig.json

The SQLite connector provides the following capabilities:

• Database Types: Supports both file-based and in-memory SQLite databases.
• Access Control: Supports read-only mode.
• Querying: Supports named parameter syntax in queries (e.g., using :param).
• Introspection: Provides automatic table discovery and column type inference.
• Integrity: Supports transactions.

CentralMind Gateway supports several AI providers. For optimal performance, the following models are recommended:

• OpenAI: o3-mini (Supports all OpenAI-compatible providers via custom endpoints)
• Anthropic: Claude 3.7
• Amazon Bedrock
• Google Vertex AI (Anthropic)
• Google Gemini: Gemini 2.0 Flash Thinking (Note: Gemini provides a generous free tier).

Detailed documentation for specific providers can be found in their respective sub-guides.

Features

• Table discovery: Automatically find tables within the dataset.
• Query execution: Run queries using parameters.
• Schema inference: Automatically determine the schema of the data.
• Row sampling: Retrieve samples of rows from tables.

Limitations

• No Primary Keys: BigQuery does not support traditional primary keys.
• Credential Format: Credentials must be provided specifically as a JSON string.
• Feature Support: BigQuery-specific features like clustering and partitioning are not exposed through this connector.

CentralMind Gateway is an AI-first data gateway designed to bridge structured databases and LLM applications. Key capabilities include:

• Automatic API Generation: Uses LLMs to create APIs from table schemas.
• Multi-Protocol Support: Exposes data via REST or MCP (Model Context Protocol).
• Security & Compliance: Automatic PII cleanup using regex and Row-Level Security (RLS) via Lua scripts.
• AI Optimization: Supports OpenAPI 3.1.0 and provides extra metadata via MCP to help agents understand the API.
• Observability: Built-in OpenTelemetry (OTel) support for auditing and tracking.
• Performance: Supports time-based and LRU caching.

The Elasticsearch connector supports three authentication patterns:

1. Basic Authentication: Provide user and password.
2. API Key Authentication: Provide api_key. When using this method, you must omit both user and password.
3. No Authentication: Used primarily for local development.

For Elastic Cloud deployments, use the cloud_id parameter instead of the hosts list.

connection:
    type: elasticsearch
    cloud_id: deployment:dXMtZWFzdC0xLmF3cy5mb3VuZC5pbyQ0ZmE...
    api_key: your_api_key

You can run DuckDB in-memory mode, which is useful for transient data or testing. There are three ways to configure this:

1. Using the memory flag (Recommended):

   connection:
     type: duckdb
     memory: true

2. Using a direct connection string:

   connection:
     type: duckdb
     conn_string: ":memory:"

3. Empty connection section: An empty connection: block defaults to in-memory mode.

Note: In-memory databases do not have the READ_ONLY restriction, but allow_community_extensions is still set to false for security.

You can enhance your MCP Raw API by adding plugins to your configuration. Available plugins include:

• PII Data reduction: Using pii_remover (Regex) or presidio_anonymizer (Microsoft Presidio).
• Security: oauth (OAuth Authentication) and api_keys (API Keys Management).
• Performance & Observability: lru_cache (LRU Cache) and otel (OpenTelemetry Integration).